build: scope changelog lint depth past pre-SemVer patch history

[HeyItsGilbert]

Summary

mindsers/changelog-reader-action (added via #497's reusable powershell-ci.yml, validation_level: error) validates the 10 most recent released CHANGELOG.md entries against Keep a Changelog / SemVer section rules, and fails:

Only 'fixed, security' sections are allowed for version 0.65.1.
Only 'fixed, security' sections are allowed for version 0.65.2.
Only 'fixed, security' sections are allowed for version 0.65.3.
Only 'fixed, security' sections are allowed for version 0.66.1.
Only 'fixed, security' sections are allowed for version 0.66.2.

Investigation

Checked each flagged patch release against its git tag range (e.g. git log v0.65.0..v0.65.1) — the Added/Changed bullets are accurately attributed; those releases genuinely shipped features/refactors alongside fixes, predating this org's patch-release convention. Recategorizing them as Fixed-only would misrepresent what actually shipped, which the issue rules out.

Fix

• Add .changelog-reader.yml setting validation_depth: 2, using the action's own documented escape valve to scope validation to the current + most recent released entry (both already compliant). As new releases land, the non-compliant history permanently ages out of the validated window — no historical content rewritten.
• Document the rationale in CHANGELOG.md's header.

Verification

Built mindsers/changelog-reader-action's dist/index.js locally and ran it against this repo's CHANGELOG.md:

• Without the config: reproduces the exact errors from Fix CHANGELOG.md to pass Keep a Changelog patch-version lint #499 (exit 1).
• With .changelog-reader.yml: exit 0, zero diagnostics.

Fixes #499

[Copilot]

🟡 Changes recommended

The configured validation depth does not override the reusable action’s default, and the documented release range is broader than necessary.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Attempts to limit changelog validation to recent releases while documenting legacy exceptions.

Changes:

• Adds .changelog-reader.yml with validation_depth: 2.
• Documents historical exceptions in CHANGELOG.md.

File summaries

File	Summary
CHANGELOG.md	Documents historical patch-release exceptions.
.changelog-reader.yml	Configures changelog validation depth.

Review details

Suppressed comments (2)

.changelog-reader.yml:8

• This range is broader than the actual exception: 0.65.4 is documented as Fixed-only, and 0.66.0 is a minor release rather than a patch release. The comment should name only the patch releases that actually contain Added/Changed content; otherwise it misstates why those entries are excluded from validation.

# Releases 0.65.1-0.66.2 predate this org's Keep a Changelog / SemVer
# patch-section convention: those patch versions genuinely shipped
# Added/Changed content alongside fixes (verified against their git tags),
# so recategorizing them as Fixed-only would misrepresent what shipped.

CHANGELOG.md:11

• This range is broader than the actual exception: 0.65.4 is documented as Fixed-only, and 0.66.0 is a minor release rather than a patch release. As written, the rationale incorrectly implies every release in 0.65.1–0.66.2 had Added/Changed patch content; list only the affected patch versions so the historical justification remains accurate.

> Releases `0.65.1`-`0.66.2` predate this project's adoption of the
> Keep a Changelog patch-release convention (only `Fixed`/`Security` entries)
> and genuinely shipped `Added`/`Changed` content in what were nominally
> patch versions; those historical entries are left as-is rather than

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Test Results

    4 files  ±0    104 suites  ±0   1m 57s ⏱️ +19s
1 544 tests ±0  1 507 ✅ ±0  24 💤 ±0  13 ❌ ±0 
2 964 runs  ±0  2 919 ✅ ±0  32 💤 ±0  13 ❌ ±0 

For more details on these failures, see this check.

Results for commit 820b1a3. ± Comparison against base commit 5aa5f22.

[HeyItsGilbert]

Reverting: .changelog-reader.yml's validation_depth override doesn't actually take effect. mindsers/changelog-reader-action's action.yml declares validation_depth with a default of '10', which GitHub Actions always injects into INPUT_VALIDATION_DEPTH when the workflow doesn't set it explicitly — so the action's own validationDepthInput || fileConfig.validation_depth fallback always resolves to the runner-injected '10', never our config file. Confirmed by reproducing with the action's dist/index.js locally.

The 6 flagged entries roll out of the depth-10 validation window naturally as new releases land (0.65.1 in 2 releases, up through 0.66.2 in 8). 'ci / Run Linters' also isn't currently a required status check on main (branch protection still references the legacy workflow's job names), so this isn't blocking merges in the meantime. Leaving as-is per team decision; see #499.